My usual first stab is housecall.trendmicro.com

If that's clean I move on to adaware and spybot s&d